Although encrypted control is a promising method for secure control, research on the security of encrypted control systems remains limited.
In most of the previous studies, an encrypted control system was assumed to be secure if the underlying cryptosystem was secure.
However, certain attacks against encrypted control systems are not considered in cryptography.
Fig. REF  depicts a typical situation in standard signal encryption.
Alice encrypts a message and transmits the encrypted message to Bob, who decrypts it.
Eve, an attacker, intercepts the encrypted data and tries to recover it.
Eve eavesdrops on the input and output of the encrypted controller while attacking the encrypted control system, as shown in Fig. REF .
This is because control systems are typically closed-loop systems.
In this case, Eve's objective is not necessary to obtain the original controller input and output.
For example, Eve may attempt to recover an encrypted controller parameter from encrypted messages.
This objective may be achievable even if Eve fails to decrypt the encrypted input and output.
Although this type of attack on encrypted control systems is fairly common, it is not considered in standard cryptosystems, including the ElGamal encryption [1]} and Paillier encryption [2]}, which are widely used for encrypted control.
Therefore, using a secure cryptosystem does not necessarily mean that an encrypted control system is secure.
<FIGURE>